Security audit

Hipaa Compliance Auditor

Security checks across malware telemetry and agentic risk

Overview

This skill is a legitimate local HIPAA redaction helper, but it can expose patient data through audit logs and console output, and its compliance claims are stronger than the implementation supports.

Review before installing or using with real patient data. Use only in a controlled local environment, avoid audit logs unless they are protected as PHI, avoid shared terminals or CI logs, pin dependencies, and require manual review before relying on any output for HIPAA-related release decisions.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation describes code behavior with file read/write capabilities, but no explicit permissions are declared. In a healthcare-oriented de-identification tool, this mismatch is risky because it processes highly sensitive PHI/PII and could read unintended files or write sensitive outputs and audit logs to unsafe locations if the runtime trusts undeclared capabilities.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The class documentation claims coverage of all 18 HIPAA identifier categories, but the implementation only detects a subset and misses multiple listed categories. In a HIPAA de-identification tool, this can create a false sense of compliance and cause users to release medical text that still contains PHI, which is a security and privacy failure rather than a mere documentation issue.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The module advertises 'clinical-grade' de-identification according to HIPAA Safe Harbor standards, yet the code itself says manual review is required and only performs limited heuristic validation. In this healthcare context, overstating assurance is dangerous because operators may trust the output as compliant and expose residual PHI in production workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The audit log records per-detection context derived from the original input, which can include snippets of PHI/PII, and does so without prominent disclosure or safeguards. In a medical-text processing skill, storing PHI-bearing logs expands the sensitive-data footprint, increases retention and access risks, and may itself create a HIPAA compliance problem if logs are not protected as regulated data.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Install with: pip install -r requirements.txt # Core NLP library spacy>=3.7.0 # spaCy models (install separately): # python -m spacy download en_core_web_trf # Best accuracy (transformer-based)
Confidence: 86% confidence
Finding: The dependency is specified with a lower bound only, which allows installation of any newer version, including releases that may introduce breaking changes or newly disclosed vulnerabilities. In a HIPAA/PHI processing skill, dependency drift increases supply-chain and reliability risk because security-sensitive text handling may change unexpectedly across environments.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # python -m spacy download en_core_web_md # Medium model, faster # Enhanced PII detection (optional but recommended) presidio-analyzer>=2.2.0 presidio-anonymizer>=2.2.0 # Advanced regex support
Confidence: 89% confidence
Finding: Using an unpinned version of presidio-analyzer creates supply-chain uncertainty for a library directly responsible for detecting PII/PHI. A future release could contain a security flaw or behavioral regression that causes missed identifiers, which is especially sensitive in a HIPAA compliance context.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Enhanced PII detection (optional but recommended) presidio-analyzer>=2.2.0 presidio-anonymizer>=2.2.0 # Advanced regex support regex>=2023.0.0
Confidence: 89% confidence
Finding: The anonymizer library is unpinned, so deployments may pull different versions over time with unreviewed security or functional changes. Because this component transforms sensitive healthcare data, version drift could lead to incomplete de-identification or unsafe output handling.

Unpinned Dependencies

Low

Category: Supply Chain
Content: presidio-anonymizer>=2.2.0 # Advanced regex support regex>=2023.0.0 # Data validation dacite>=1.8.0
Confidence: 80% confidence
Finding: An unpinned regex dependency permits uncontrolled upgrades that may introduce parser bugs, denial-of-service edge cases, or incompatibilities. While lower risk than the PHI-specific libraries, it still contributes to supply-chain exposure in a security-sensitive text-processing pipeline.

Unpinned Dependencies

Low

Category: Supply Chain
Content: regex>=2023.0.0 # Data validation dacite>=1.8.0 # Testing pytest>=7.4.0
Confidence: 78% confidence
Finding: The dacite package is unpinned, which weakens reproducibility and allows silent intake of future releases with unknown security posture. Although it is not the primary PHI-processing component, compromised or buggy dependency updates could still affect handling of sensitive data structures.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dacite>=1.8.0 # Testing pytest>=7.4.0 pytest-cov>=4.1.0
Confidence: 91% confidence
Finding: pytest is unpinned, so environments may install a version with known flaws or incompatible behavior. Even though it is a test dependency, vulnerable developer tooling can affect CI systems and local development environments, and this finding is reinforced by a reported advisory on pytest.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Testing pytest>=7.4.0 pytest-cov>=4.1.0
Confidence: 83% confidence
Finding: pytest-cov is specified as a minimum version only, allowing unreviewed upgrades in CI or developer environments. This is primarily a supply-chain and reproducibility risk rather than a direct runtime exposure, but it still broadens the attack surface of the build pipeline.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dataclasses spacy
Confidence: 92% confidence
Finding: The dependency `dataclasses` is unpinned, allowing future installs to resolve to different versions over time. While `dataclasses` is a backport and often unnecessary on modern Python versions, leaving it unconstrained can introduce supply-chain risk, unexpected behavior changes, or vulnerable package versions in environments processing sensitive PHI.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dataclasses spacy
Confidence: 97% confidence
Finding: The dependency `spacy` is unpinned, so installations may pull in different versions and transitive dependencies over time. In a HIPAA-oriented skill handling medical text, this increases supply-chain and reproducibility risk: a compromised or vulnerable release could affect confidentiality, integrity, or availability of PHI processing.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

Category: Supply Chain
Confidence: 72% confidence
Finding: The file includes pytest without an upper bound or exact version, and static analysis reports an advisory affecting pytest tmpdir handling. If a vulnerable version is installed in CI or local testing, an attacker may be able to abuse filesystem handling during test execution, impacting developer or pipeline environments.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.